Search

CVE-2026-84306 - Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

CVE ID : CVE-2026-84306 Published : Sept. 1, 2026, 7:10 p. m. • 6 minutes ago Description : Filament is a collection of full-stack components for accelerated Laravel development. From 4. 0. 0 until 4. 12. 6 and 5. 7. 6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication. php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable.